CVE-2026-94106: getID3 OS Command Injection Vulnerability

CVE-2026-94106 Overview

CVE-2026-94106 is an OS command injection vulnerability [CWE-78] affecting the getID3 PHP library before version 1.9.26. The library, maintained by James Heinrich, extracts metadata from audio and video files. Several shell-out handlers in getID3 pass filenames directly into command strings without escaping shell metacharacters. Attackers who control filenames processed by an application embedding getID3 can inject arbitrary shell commands. Injected commands execute with the privileges of the process invoking the library, which is often a web server user.

Critical Impact
Attackers can achieve arbitrary command execution on the host by supplying filenames containing shell metacharacters to any application that uses vulnerable getID3 shell-out handlers.

Affected Products

getID3 PHP library versions prior to 1.9.26
Web applications and content management systems that embed vulnerable getID3 releases
Media processing pipelines that pass user-supplied filenames to getID3 shell-out handlers

Discovery Timeline

2026-09-20 - CVE-2026-94106 published to the National Vulnerability Database (NVD)
2026-09-22 - Last updated in the NVD database

Technical Details for CVE-2026-94106

Vulnerability Analysis

The vulnerability resides in getID3 shell-out handlers that invoke external helper binaries such as shorten.exe to decode audio streams. Vulnerable handlers concatenate the $info['filenamepath'] value directly into a shell command string wrapped only in double quotes. Because PHP does not escape shell metacharacters inside double-quoted command arguments, any filename containing characters such as `, $, ;, |, or " breaks out of the intended argument context. The library then passes the resulting string to a shell interpreter, which executes any injected commands.

The VulnCheck advisory and GitHub Security Advisory GHSA-qf3m-pmjh-h6fx describe the issue as affecting multiple shell-out paths that failed to apply escapeshellarg().

Root Cause

The root cause is missing input sanitization at the boundary between PHP code and the operating system shell. The library trusted the caller to sanitize filenames before invoking metadata extraction. When applications forward user-controlled input, such as uploaded filenames, that trust boundary breaks. The fix, tracked in GitHub Issue #503, replaces manual quoting with PHP's escapeshellarg() function across affected handlers.

Attack Vector

An authenticated attacker who can influence a filename processed by getID3 supplies a crafted name embedding shell metacharacters. When the embedding application calls a vulnerable analyzer such as getid3/module.audio.shorten.php, the shell parses the metacharacters and executes attacker commands under the web server account.

php

// Vulnerable pattern (before patch) in getid3/module.audio.shorten.php
$commandline = GETID3_HELPERAPPSDIR.'shorten.exe -x "'.$info['filenamepath'].'" - | '.GETID3_HELPERAPPSDIR.'head.exe -c 64';
$commandline = str_replace('/', '\\', $commandline);

// Patched pattern (v1.9.26) – filename is escaped
$commandline = GETID3_HELPERAPPSDIR.'shorten.exe -x '.escapeshellarg($info['filenamepath']).' - | '.GETID3_HELPERAPPSDIR.'head.exe -c 64';
$commandline = str_replace('/', DIRECTORY_SEPARATOR, $commandline);
// Source: https://github.com/JamesHeinrich/getID3/commit/ce598c4f3823441d878c5a7a2a9f2f703a3e10b6

Detection Methods for CVE-2026-94106

Indicators of Compromise

Uploaded or referenced filenames containing shell metacharacters such as `, $(, ;, |, or embedded quote characters.
Unexpected child processes of the PHP-FPM or web server process, particularly sh, cmd.exe, shorten.exe, or head.exe spawning secondary utilities.
Web server access logs recording multipart uploads with filename fields containing command substitution syntax.

Detection Strategies

Inventory installed PHP dependencies and flag any getid3 package with a VERSION constant below 1.9.26.
Instrument the web server to log process creation events and alert on PHP spawning shell interpreters with arguments not present in a known-good baseline.
Perform static review of application code paths that pass user-supplied filenames into getID3 analyzers without prior filename normalization.

Monitoring Recommendations

Forward process telemetry from web servers into a centralized analytics pipeline and hunt for shell child processes of php, php-fpm, or httpd.
Monitor filesystem writes under upload directories for filenames containing shell metacharacters and quarantine matches for review.
Track outbound network connections initiated by web server processes immediately after media upload events to detect post-exploitation callbacks.

How to Mitigate CVE-2026-94106

Immediate Actions Required

Upgrade getID3 to release v1.9.26 or later across all applications and container images.
Audit application code that invokes getID3 to ensure user-controlled filenames are normalized before analysis.
Restrict the file system and shell privileges of the web server account to limit blast radius if exploitation occurs.

Patch Information

The fix is delivered in getID3 v1.9.26. Relevant upstream commits include 2c6f3f9, which updates the version constant, and ce598c4, which introduces escapeshellarg() around filename arguments and replaces manual path separator substitution with DIRECTORY_SEPARATOR.

Workarounds

Rename uploaded files server-side to a whitelist of safe characters (for example, [A-Za-z0-9._-]) before invoking getID3.
Disable getID3 features that rely on external helper binaries such as shorten.exe if metadata extraction for those formats is not required.
Execute media processing in a sandbox or container with no-new-privileges and a restricted binary set to contain command injection attempts.

bash

# Composer upgrade to the patched release
composer require james-heinrich/getid3:^1.9.26

# Verify installed version
php -r "require 'vendor/autoload.php'; echo getID3::VERSION;"